Latest / Identity at the Center / #277 - IDAC & AI Answer Listener Questions

Transcript

#277 - IDAC & AI Answer Listener Questions · Identity at the Center

0:00
Where do you think you are now? You're
0:02
probably way behind the curve. You're
0:04
probably like, you know, getting breached and stuff
0:07
like that. You can't take a vacation from
0:10
investing. Hey, I'm not saying I agree.
0:12
I'm just trying to play AI
0:14
advocate here. I'm trying to think really hard
0:17
because budgets are tough. And
0:19
if you have magic IAM people, IAM heroes is what
0:23
I like to say, running around behind the scenes,
0:24
just making it work. And the organization doesn't
0:27
feel the pain of not having modern tools, let's
0:31
say. Could you have gotten away with
0:34
it? I would argue, yes, it
0:35
happens. It still happens today, right?
0:37
But should you? You
0:38
can get away, Jeff, you can get away without buying
0:41
life insurance. But if you die, then your
0:46
family will have no money. Well,
0:48
that's their problem, not mine. Yeah.
0:50
Yeah. This is identity at the center.
1:00
If it has anything to do with
1:02
IAM, this is the go to podcast. Now
1:07
your hosts, Jim McDonald and Jeff Steadman. Welcome
1:17
to the identity at the center podcast. I'm
1:19
Jeff and that's Jim. Hey, Jim. Hey,
1:21
Jeff, how are you? Oh, not so bad yourself. I'm
1:25
doing great, man. I'm in a good mood. How
1:27
are you feeling? Oh, all right, you caught me.
1:29
I'm a little crabby and I
1:31
don't know why. I just have one of those
1:32
days, I think. You know, whenever I'm feeling
1:35
crabby, I think about crabby patties and how
1:39
they're like the jam. I never actually had a crabby
1:43
patty, but that was like the hamburger looking thing
1:46
that they had on SpongeBob. Any
1:48
time to have a crab cake? No,
1:51
no, like the hamburgers on SpongeBob that they made at
1:54
Mr. Crab's restaurant. Jim.
1:57
Have you ever watched SpongeBob? Jim,
1:58
I'm a grown ass man. I have never seen SpongeBob.
2:01
Oh, you're missing out, bro.
2:03
You're missing out. It's
2:04
not, it's not, it's like the Simpsons. It's
2:08
a cartoon, but it's something like hidden. I've
2:11
seen pictures of it. I've seen like memes or
2:14
something like that. It's funny, whatever, but no,
2:16
I've never, I've never sat down and I don't think
2:18
I've ever seen more than three seconds of a
2:20
SpongeBob thing. Oh, yeah. I'm
2:23
missing out, man. So is this something you're
2:25
doing? Just watching SpongeBob all the
2:27
time? Well, no, I guess I did have
2:30
kids that were in the right age range for that
2:34
show for a while. So I'd wind up watching it.
2:37
But then I realized that, oh,
2:38
there's one of those cartoons that's meant to
2:42
keep adults entertained as well, like Simpsons. See,
2:45
there you go. I don't have kids. So
2:46
I never, I never have not gone through any of those
2:48
phases. Just keep just watching a
2:50
pursuit or two. Like, what do you have to lose?
2:53
I don't know. You're
2:56
not in the right mood for that kind of suggestion.
2:58
Yeah, yeah, don't try and don't
2:59
try and solve the problem, Jim. I
3:00
just want to be crabby. Crabby
3:04
patties. Well, you know, one thing that
3:06
I'm not crabby about, and this is kind of a
3:08
milestone for us this morning, was we crossed
3:10
over 300 ,000 downloads of this tiny little IAM
3:15
podcast, not so tiny anymore, I guess. I
3:17
know. I'm going to sound like a
3:19
broken record to say. I remember when we had 20
3:21
downloads of the first episode and we knew all 20
3:24
people were. But we literally just started
3:27
by you saying one day, let's start a podcast. I
3:32
was like, OK, thinking this won't last. We're
3:35
coming up on 300 episodes and 300 ,000 downloads.
3:38
Pretty amazing. Well,
3:40
it's pretty amazing as it took. Yeah,
3:41
we had no idea we were doing 100 ,000. And
3:43
it took four and a half years, roughly, to get to
3:46
100 ,000. Because I remember we celebrated
3:48
that at Adeniverse last year. And
3:51
we're at 300 ,000 and it's less than a year later,
3:54
which is absolutely bananas. And
3:56
we saw a ton of growth just within the last
3:58
several months and stuff like that. But
4:00
it's a lot of fun. We still do it. You
4:03
know, this is not our job. We
4:05
do it because we like doing it. And,
4:07
you know, thank you, everyone who's listened,
4:09
subscribed, shared, you know, all that fun stuff.
4:12
And yeah, it's kind of fun to
4:14
take a step back and, you know, that'll probably put
4:16
a smile on my face now here for a little bit.
4:18
Yeah, well, you know, just
4:19
thinking about it, like that doesn't include our
4:21
YouTube stats. So if you count those in, we
4:24
have like 301 ,000 downloads. No,
4:28
300 ,000 and one, you mean? Our
4:31
YouTube channel is still very small, but we are
4:34
putting more emphasis on it. Starting
4:37
to think about how we're going to do video episodes.
4:41
Still a little bit of a
4:42
challenge from a timing perspective, just, you know,
4:44
forth, forth, forth wall here is we're recording
4:46
this on a Friday. And this needs to go out
4:49
Monday. I have other stuff to do and
4:52
I still need to get this edited once we're done and
4:55
trying to figure out how that quick turnaround will
4:57
work. So this might end up being
4:58
only an audio episode, but if it, if I have time, I
5:02
can figure out a good workflow and get better at
5:04
it. There may be video episodes
5:06
showing up on YouTube. So go to our YouTube channel.
5:09
Subscribe, like, do all that stuff
5:11
the same way we'd built up the audio podcasts. We're
5:14
going to keep doing that, but we're going to start
5:15
doing video as well. Um, as time permits and
5:18
hopefully time will be more permitting in the future.
5:21
Yeah, because the real thing is
5:23
like, I think when people find out about the podcast,
5:26
probably half of those people will continue to
5:30
listen or in the future, watch the podcast. So
5:33
when people go out and like and subscribe, it
5:35
helps more people find the podcast and. You
5:39
know, hopefully, I mean, the way I look at it is
5:41
it's a community. I depose a community. I
5:45
think the listening of identity center is a
5:49
community. I see a lot of people, you
5:51
know, really get a lot of value out of it. And
5:55
we get to meet folks and introduce those folks to
5:58
other folks. And it's, it's everything I
6:01
hoped it could be. Yeah, it's a lot of fun. We're
6:06
having fun doing it and we try to keep it fresh. So
6:09
we'll keep doing it until one or both of us gets
6:11
bored. And then that'll be it. Let's
6:16
see, it's a Friday night. What
6:18
do we want to talk about this week? I
6:21
think, well, first we have to talk about like all the
6:24
conferences that are coming up. The
6:26
first one is identityverse. As
6:28
everyone knows, it's like the one of the biggest
6:31
conferences within the digital identity industry.
6:35
It's May 28th through the 31st
6:38
at the ARIA. We've got a 25 % off discount
6:42
code. It's IDV24 -IDAC25. It's
6:48
kind of a long code. But hey, when you get 25 %
6:51
off, I think it's worth using. And
6:54
you pretty much go to identiverse .com and you can
6:56
figure out how to go through the registration
6:58
process. I know early bird pricing is
7:02
up soon and might already be up. But
7:05
the longer you wait, the more expensive it gets. So
7:08
I'd say get out there and register as soon as
7:11
possible. Jeff and I are going to be
7:13
there. We'd love to meet every one of
7:16
our listeners or as many people as want to come up
7:19
and introduce themselves. We'll
7:21
be at multiple places. So we're having a happy hour.
7:28
I think it's Tuesday night,
7:29
but reach out to Jeff Rai on LinkedIn. Choose
7:33
the DM if you're interested in meeting us and going to
7:37
the happy hour. It's going to be with TALUS.
7:40
It's going to be at the one of
7:42
the bars in the ARIA. I think, do you remember what
7:45
it's called? I don't remember, but it's
7:46
with TALUS and RSM, right? I
7:47
think that's the plan. Yeah,
7:49
TALUS and RSM. We're also going to be recording
7:53
live episodes. So there's one room that's
7:56
kind of like a fishbowl recording studio. And
8:00
folks can stand outside of that, look in and they
8:03
have headphones available that people can put the
8:05
headphones on and listen to what's going on. I
8:08
know you're laughing, Jeff, but that's a huge
8:10
improvement versus what we did last year where nobody
8:13
could hear us. Yeah. I mean, there's two
8:16
options, right? You can either, I think that's
8:18
going to be in between both of the expo halls.
8:20
There's two expo halls this year.
8:22
It'll be a fishbowl. We're
8:23
kind of sharing it with the CRA, TV folks, the
8:26
folks who help put on a number of cyber risk
8:29
alliance. We've been great partners
8:30
throughout this. So we'll kind of be using
8:32
unused time from them and we'll also have a
8:35
conference room somewhere. I don't know exactly where it
8:38
is yet, but there will be a sign outside of it where
8:41
people should definitely be able to hear us then
8:42
because it'll be a little bit further away from
8:44
everyone. We'll be kind of in a room.
8:46
We'll have different guests. I
8:47
hope we'll have some chairs, maybe one or two
8:49
people will show up and watch us kind of record
8:50
one of these things live. And
8:51
yeah, that'll be a lot of fun. Yeah.
8:56
So the third thing, we had a third thing going on as
9:01
well for people, we're going to be with RSM and
9:06
TALIS at the TALIS booth or whatever. Yeah.
9:12
Was that the booth or whatever it is on the expo
9:14
floor? Expo hall. So
9:16
there's going to be an opportunity to drop by and
9:18
meet us there as well. Again,
9:21
if like you're interested in any of those things,
9:22
just reach out to us with DMs or play it by ear.
9:27
We'll drop by any of the things.
9:29
Just like we do here on the
9:30
podcast, just we'll do it live. Just
9:32
yeah, just wing it. Yeah. I'm also hosting a or
9:35
moderating a panel, I guess, probably a good way.
9:37
So former guests on the show,
9:41
Sean O'Dell and a tool, Toolshed Bagway, are going
9:45
to be talking about CAPE, C -A -E -P, Continuous Access
9:48
Evaluation Profile. And they've asked me to
9:50
moderate a panel that they'll be on. So
9:52
I will be the everyday man trying to figure out what
9:55
the heck they're talking about as I moderate the
9:57
session. So that'll be on Wednesday,
9:59
May 29th at 1140 AM. So I hope people come out and
10:02
check that out too. I've not done a lot of
10:04
moderating for conferences. I
10:06
guess maybe my second or maybe third time. So
10:09
watch me be nervous up on a stage with a bunch of
10:11
people. Yeah, that was such a good
10:14
episode that we did. I mean, those guys are really
10:16
on some of the cutting edge stuff. So
10:18
I think a lot of us in our day to day, we're
10:21
doing things that have been kind of established. I
10:25
always think of identity as like, for the most part,
10:28
you're kind of like doing things that have been
10:31
proven to work. People call it best practices. I
10:35
don't like that term, but they're proven technologies.
10:39
These guys are kind of like
10:40
moving into areas that are, I wouldn't call it bleeding
10:43
edge, but they're newer. Like
10:45
CAPE is newer. So you can learn a lot
10:48
because I think, if it picks up steam and gets
10:52
more folks adopting, it's going to be proven
10:55
technology. You know, Sean would probably
10:58
already argue it is proven technology, right? But
11:01
he's out there proving it. Yep,
11:03
exactly. So then let's see, after a
11:06
Denver, we've got people probably hopping on a plane
11:08
going straight to European identity and cloud
11:10
conference that is June 4th or the 7th in Berlin. We
11:14
have a discount code for that as well. EIC
11:16
24 IDAC 25 gets you 25 % off. We'll
11:20
have a link in our show notes for that one. We
11:22
will not be there, but fortunately we have a code
11:24
that we can share with folks. Well,
11:26
we will be back later this year is identity week and
11:28
there's a handful of conferences throughout the
11:30
year. So there's Europe, which is in
11:32
Amsterdam, June 11th and 12th. There
11:35
is Americas, which is Washington, DC, September
11:39
11th and 12th. That's the one Jim, you and I
11:41
will be at. And then Asia, October 22nd,
11:44
23rd IDAC 30 gets you 30 % off of all of those
11:50
conferences. So looking forward to that. So
11:53
kind of cool. One of the things we should do
11:54
is kind of try to highlight the different
11:57
conferences that are happening throughout the
11:58
year. I think we'll have
11:59
authenticate coming up at some point later this year.
12:01
I mean, it'll be happening,
12:02
but we'll have, I hope a discount code for that one.
12:04
So that people can reach for
12:05
that. And Andrew Shikiar will come
12:08
back on the show and help us understand like what's
12:12
going on there. We'll play a part in that with
12:14
the podcast. I also wanted to mention RSA
12:17
is coming up. We don't have a discount code
12:19
for that, but how many times have you been asked
12:22
so far, Jeff, if you're going to be at RSA? I
12:25
think everybody has asked and I, I have been in the
12:28
past. I think this is the second
12:29
year in a row that I haven't gone, but I think
12:31
there's probably a streak of like three or four that
12:32
I went to, but just not this year. So
12:35
here's my approach to it. I
12:36
mean, I'm not looking to ask you to try to put it
12:40
down or anything or pump it up. But
12:43
what is your, what's your thought on RSA? I
12:45
think it's great for meeting folks. I'll
12:47
be honest. I don't think I've ever
12:48
actually attended a session. The
12:50
way that I go, and this is a pro tip for folks is
12:52
if you want to go to RSA and it's expensive, for
12:56
sure, get just the business hall pass and go walk to
12:59
the expo hall. You can literally spend two
13:01
days just exploring it, seeing what new technologies
13:03
are out there and stuff like that. That's
13:05
usually what I go for is that kind of thing.
13:08
Everyone wants to know you might be
13:10
able to sneak into a side room or something like that
13:11
to catch a session. But I don't remember, I don't
13:14
know what it cost this year, but it was like 50
13:15
bucks a couple of years ago. You
13:17
know, maybe it's gone up in price, probably like
13:19
everything else. But that was all as my pro
13:20
tip for RSA was just even, you know, if, if you're
13:24
looking to save some costs, the money you save on
13:26
travel or the money that you save on the, on the
13:29
conference pass can be for the travel that's a little
13:31
more expensive for services. Let's
13:31
go. Yeah. My problem with San
13:34
Francisco is like $400 hotel rooms per night. I
13:38
mean, they would move it to Vegas. You
13:40
could get a lot cheaper. I mean, $200 and now you can
13:44
get a nice hotel room. Yeah.
13:46
Let's Vegas. It's built for that, but some
13:48
people don't like Vegas either. So
13:49
can't win. Can't win. You
13:52
can't make everyone happy. Yeah.
13:54
Well, let's see. How can, how can we make some
13:56
people happy this week, Jim? Mailbag?
13:58
We can, we can respond to their questions. Okay.
14:01
And you have this crazy idea of how we're going to
14:05
respond to these questions from listeners out in the
14:09
world. Explain your idea here so that we
14:13
can kind of set the stage because this is definitely
14:16
going to have visual as well as audio components to
14:19
it. And we're trying to make sure
14:20
this comes off well for audio too. Yeah.
14:23
Yeah. So considering the audio
14:26
podcast aspect of it, we're going to read off the
14:30
questions that we've gotten, uh, these are real
14:33
questions and we'll put them into an AI engine. So
14:39
we're going to use gem, Google's Gemini, not just
14:42
Gemini, Gemini advanced. Cause
14:44
I should pay for it. We're going to use the advanced
14:45
version. So I have no idea what's
14:48
going to happen, but we'll enter them in. Jeff
14:51
is very good at like command line prompting or
14:54
prompt engineering. They call it, right? There
14:56
you go. So he'll get us to as tight
14:59
of a answer as possible or say it's a bit of an
15:02
answer and it's like two pages long. We're
15:04
not going to bore you by reading that. I'm
15:06
going to get down to kind of like, you know, top
15:09
five or, you know, short descriptions. Then
15:11
we're going to read them off. Obviously,
15:14
if, if we get this out to YouTube and you can see
15:17
the questions, you can see everything, the AI outputs.
15:20
But I mean, I think the
15:23
takeaway from doing this is like folks can start to
15:26
get the idea of like, all right, this is what you
15:28
might be able to get from AI. If
15:31
they're not using it already, like we are, and,
15:34
you know, put in like top five of this or top 10 of
15:38
that, see what comes back. And
15:40
then my thing with AI is like, I kind of felt like
15:44
my first start using it, like the answers were so
15:47
super generic that anybody who had been in the
15:51
industry for five or more years, but would know more
15:54
nuance than what it was spitting out. So
15:56
I'll be real interested, like literally we're
15:59
entering these for the first time as we go. So
16:02
we'll be evaluating how good the answers are and
16:05
whether or not we agree with them. Yeah.
16:07
And hopefully helping out some listeners who actually
16:09
sent some questions in. So your mileage is going to
16:12
vary based on whichever AI model using. I
16:15
just happened to pick Gemini Advanced is the one
16:17
we're using today, but if you're using Claude or if
16:20
you're using open AI, AKA chat, chat GPT or
16:23
Microsoft's version of, of chat GPT, the reason I
16:27
like Gemini is it's tied to Google, which means
16:30
theoretically it should pull back more current
16:33
information than some of the other models that are
16:35
not trained on anything that's like within the last
16:38
year or so. The only exception to that, I
16:40
think is meta put out their AI model this week,
16:43
meta .ai. You can go to the website and
16:45
that's supposed to be connected to both Google
16:47
and Bing, but I have not really tried it out yet to
16:50
see how good it is. So we're going to just go
16:52
with Gemini. I just know that mileage may
16:53
vary. So let's see here. I'm
16:55
going to put this question for you just to start.
17:00
What is the top identity or
17:03
digital identity podcast? Are
17:05
you going to make me take this out? What
17:08
is the top identity and access management podcast in
17:15
the world? Yeah, this is going to be very
17:17
embarrassing when it comes back with no idea who
17:18
you're talking to. Yeah, there is no top. All
17:22
right. So it's not even giving like
17:24
answers. So it's, you know, basically
17:26
saying, okay, well, where subjectivity, evolving
17:29
landscape, consider your interests, and then where
17:33
to find podcasts like, oh, we're on here. Where
17:36
to find podcasts. So podcast directories like
17:38
Apple Spotify, blogs, some popular IAM podcast gets
17:42
you started in no particular order. Just
17:44
something called identity and access management. I
17:46
don't know what that is. Let's
17:47
talk about digital identity. That's
17:49
by the folks over at Ubi Secure. I
17:50
know I've heard about that one. Manage
17:52
engines, identity and access management podcast series. I
17:55
am pulsed by Biokey International. I'm
17:58
not sure if I know what that is. The
17:59
identity brief and there we are. Identity
18:01
at the center. So hey, I'm going to guess.
18:03
No particular order, but we're
18:04
last. Yeah. So all right. Well,
18:07
that was a good warm up. Let's
18:08
take the first question. This
18:09
one's from Jay in the USA. And
18:12
let me go ahead and paste this in here. Jim,
18:14
you want to read the question while I'm getting
18:16
this set up? Sure. So the question is, what
18:18
are the top IAM metrics an organization should collect,
18:22
track or monitor for? Okay. And so the way I've done
18:27
this is. Yeah. What you added was give
18:29
this, go ahead. No, no, go ahead. I
18:32
was going to say what you're going to do is for
18:34
like a comp engineering perspective, give this an
18:37
executive summary format with no more than five
18:40
points. Yeah. And hopefully that keeps it
18:42
to like one page. So there's not a lot of
18:44
scrolling and stuff like that. But
18:45
yeah, there we go. So that was kind of the idea
18:47
was, okay, take the top five points here. So
18:49
one of the top IAM metrics and organizations should
18:52
collect, track or monitor for an executive summary
18:54
format with no more than five points. Let's
18:58
see. So to ensure effective identity
19:00
and access management, organizations must prioritize
19:02
the tracking of crucial metrics. Here
19:04
are the breakdown of the top five. All
19:05
right, Jim, you read them off. All
19:07
right. First is time to provision and
19:09
deep revision. Second is privileged account
19:12
activity. Third is failed login attempts.
19:16
Fourth is number of inactive or
19:19
orphaned accounts. And number five is IAM policy
19:23
compliance. Okay. So I'm going to pick on
19:28
some of these and say what I think about them. Like
19:30
number one, time to provision and deep
19:32
provision. If you're just talking about
19:35
fully automated processes, like what's the point of
19:40
tracking the amount of, yeah. Like,
19:42
oh, that took like 12 seconds. Right.
19:45
If you're talking about something that's
19:48
disconnected, probably you're having to go out to an
19:50
outside ITSM system to get the information. And
19:56
that's a kind of a complicated thing. And
19:59
you may not have all that automated to pull that
20:02
metric. Are you going to do all the
20:04
figuring of that out just to provide a metric? I
20:08
just, you might have to. That
20:09
might be the reason why you go for, if you're not
20:12
automated today, we're spending way too much time
20:14
on tickets, creating active directory accounts or email
20:17
accounts or X accounts, whatever it may be. Well,
20:20
let's do the analysis. How much time did we spend
20:22
when was ticket created? What's
20:24
the dwell time or how long has the ticket been open
20:26
between when it was created and when it was resolved?
20:30
You know, does it, is it four
20:31
hours, two hours, 48 hours, three weeks, you know,
20:35
whatever it may be. So I think it's, I still
20:38
think it's a relevant metric, even though you
20:41
should be automating chances are you're not automating
20:44
everything. And that metric might give you
20:47
either a piece of mind to say, okay, we've automated
20:49
as much as makes sense, or we're deprovisioning accounts
20:53
within what we said was a policy, we will turn off
20:55
accounts within 24 hours of notice, eight hours of
20:58
notice immediately. Are you actually doing that for
21:02
the automated ones? Yes. Because it's programmatic
21:05
for the manual ones, theoretically, right? Those
21:08
probably go into a ticket queue. Does
21:11
someone get paged in the middle of the night to
21:12
say, oh, Jeff's gone. I've shut down his account and
21:16
make sure that he doesn't have access over the
21:17
weekend, right? Things like that. Yeah.
21:20
So in my mind, one of the things you can do with
21:23
metrics is show how you're improving over time. And
21:28
so I think that one potentially could show
21:31
improvement over time. But here's what I don't want
21:35
to do, which is, all right, right now I'm at
21:39
two minutes to provision everything I provision. Now,
21:44
I'm thinking about like bringing these other apps
21:47
into my scope, they're going to have to be
21:49
manually provisioned. That's going to screw my metrics.
21:52
Maybe I'll just like say they're
21:53
not, I'm not going to do that, or I'm going to do
21:56
one at a time so it doesn't affect my metrics
21:58
too much. So are any of us that
22:02
devious? No, of course not. But
22:04
it's like a, the motivation is a negative motivation to
22:09
doing it. Well, if you're working in a
22:11
large call center, ticket resolution time is a metric
22:14
that staff gets measured by. I
22:16
know because I got measured by it when I was in the
22:18
call center. So that's why I background was
22:19
how long did it take you to do it? That
22:22
can be a negative, right? Cause
22:24
you're now motivated to hang up the phone and that
22:27
call. Get the person to agree that
22:29
they, you know, I can't help you. Can
22:32
we hang up the call? Like, all right. What
22:35
really matters is was the person's issue resolved to
22:39
their satisfaction. Now you could just kick them
22:41
out to some kind of survey, but however you
22:45
wind up gathering that metric, I think when it
22:47
comes to provisioning or onboarding or and it takes
22:52
two days or three days, if you go from three days to
22:55
two days, yeah, that sounds better, but if the person
22:57
feels like in the three day scenario, they knew
23:01
what was going on and like, they're getting
23:04
constant updates versus the two day scenario where, you
23:08
know, they weren't getting updates or they just felt
23:10
like nobody cared. You know, then your customer
23:14
satisfaction score is going to be potentially worse
23:17
than in a two day scenario. I
23:19
mean, it's all about customer satisfaction when
23:21
it comes to something like this. Well,
23:22
that's why most taking systems have a stat, have
23:24
different statuses of resolved versus closed
23:28
resolved means we think the problem is resolved. And
23:31
you have X number of days or hours or whatever it is
23:34
to reopen that ticket and say, no, this is not
23:37
resolved, whatever troubleshooting or whatever
23:40
thing you did did not work, right? Or
23:41
in this case, the access provided is still not in
23:44
place or isn't working correctly. You
23:46
can reopen the ticket. So ideally you would measure
23:49
the final status, which is closed. Now,
23:52
if I think I've done the work correctly, you know,
23:55
and I mark it as resolved and no one tells me that
23:58
something's not right or not working, I'm going to
24:00
assume it's correct. So you could measure, you
24:02
know, how many tickets were, you know, marked as
24:05
closed and shouldn't have been, but then how do you
24:08
kind of match a new ticket to the old ticket because
24:10
you don't really want to reopen a closed ticket, be
24:14
able to measure that time. So
24:16
it gets a little bit sticky within that regards,
24:18
but I still think it's a valid metric just to be
24:20
able to articulate how much time do we spend in
24:23
identity and access management. If
24:25
you had to sit down and like track, you know, like
24:28
a consultant, let's say, Jim, like, you know, how
24:30
many hours or days or minutes do we spend on
24:32
each task? And if you're out there in the
24:34
real world, you know, doing identity stuff, track it
24:36
for one day. And I think you'd be shocked
24:38
on how much time you're spending on each individual
24:41
task. It probably adds up quite a
24:42
bit. It's like people have full -time
24:43
jobs on this. I kind of think that you
24:46
need to incentivize the right behavior. And
24:49
if what you're incentivizing is potentially shortcuts or
24:52
if you're trying to get off the phone, I think
24:54
we've all been on the receiving end of that. Your
24:58
customer satisfaction, your satisfaction level goes
25:00
down. And really that's what you're
25:03
driving for is, you know, and a lot of organizations
25:05
say, Hey, we're going to outsource this part of our
25:09
organization. Maybe it's the help desk, for
25:13
example. And then the help desk is kept
25:16
to like, if you don't end the calls on average, time
25:19
of 10 minutes, then you're going to lose 20 % of your
25:22
money. So then the manager within
25:25
that call center is like, close those darn calls. And
25:28
if you have to like provision part of the
25:29
access because you don't know what the full access
25:33
is, provision part of the access and close it. Now,
25:36
the customer is going to be like, okay, I still,
25:38
yeah, you closed my ticket, but I still don't have the
25:41
access I need. That's a huge fail. So
25:44
it's all about incentivizing the right behavior, just
25:47
like bonuses. When you pay bonuses to people,
25:49
it should be because we're doing the behavior that you
25:52
want them to do, not just that, you know, we're doing
25:55
extra. The extra might not be helpful.
25:59
All right, we're never going to
26:00
get through this entire list. And
26:01
in one show, if we spend 10 hours at each point.
26:04
One question, everybody. So
26:06
not one question, one question, one point. Yeah,
26:09
right. So let me move on. All
26:10
right. The second one is privileged
26:11
account activity. I'm going to read this one
26:14
out. Monitor's the use of accounts with
26:17
elevated permissions, Ergo administrators. This
26:21
is vital in detecting potential misuse or breaches
26:25
targeting sensitive data. Personally,
26:29
opinion like big red X, this is not, this is not
26:33
a top I am metric to track. Not
26:37
tracking privileged account activity. It's
26:41
not a metric. What's the metric? How
26:43
many times you're like, how many admins do you have?
26:46
How long were sessions,
26:48
privileged sessions running? Okay.
26:52
How many admins you have potentially, but if you go
26:56
from 70 privilege admins to 71 or 75, like, are you
27:03
doing things poorly? Or if you go from 70 to 65,
27:07
are you doing things well? I
27:09
don't know that that adds up to me. That's
27:12
not a good metric. This is how people gain access
27:15
to systems as they elevate, right? Up
27:17
and over. So let's say you're a small
27:19
organization and you have 10 domain administrators,
27:22
even that might be actually might be too many for, for
27:24
even a large company. Let's say you have five domain
27:27
administrators and you have a learning set up to say,
27:29
Hey, if there's any domain, a new domain administrator
27:31
account pops up, we have six. That's
27:34
immediately a problem because we should only have
27:37
five at all times. The keyword used there was
27:39
alerting. Absolutely. That, but that's not a
27:42
metric to track. To me, a metric to track is
27:45
like something that shows progress in one direction
27:49
or the other. I, that's why I don't think
27:52
that's a good one. Well, the next one failed.
27:55
Collect, track and monitor or
27:57
monitor for. Or monitor. What
28:03
are the top line metrics an organization should
28:04
collect, track or monitor for? I
28:06
do think you should be monitoring your privileged
28:08
access. I think you should know who
28:10
is privileged. You should have a count on
28:12
that somehow. You should be able to identify
28:15
when there is weird behavior taking place,
28:18
whether it's session length or maybe it's kilobytes,
28:22
megabytes, gigabytes transferred in a session.
28:24
What if I'm dumping an S3
28:25
bucket through a privileged session that I shouldn't be
28:27
doing like things like that. Those
28:28
are things that I would want to monitor for. I
28:31
don't know if I put that in an executive summary
28:32
dashboard. And this is, you know, the
28:35
wrong format for that, but I do think it's a valuable
28:37
metric. Well, you sold me on what you
28:39
just said there, but it just feel like you colored
28:43
outside the lens a little bit versus like metrics,
28:45
but yeah, no, I, I agree with everything you said. I
28:49
found log in attempts, I think is a good one, but
28:51
I also think it's. So I think so many of them
28:57
progress over time. It doesn't even make a sense.
28:59
I mean, anybody who has a
29:01
Microsoft personal account, go to your Microsoft
29:02
personal account and look at your account, log in
29:06
attempt history. And I bet you, you will find
29:09
thousands, hundreds of thousands, millions of
29:12
attempts that are just automatically blocked and,
29:14
you know, they're just, it's just, you know,
29:16
password spray attacks. People
29:18
are just trying to get in, you know, brute force,
29:20
whatever it may be. And Microsoft just blocks by
29:22
default. So yeah, this is definitely
29:23
not Jeff trying to log in from X country, you know,
29:27
48 ,000 times within the last minute, right? Stuff
29:29
like that. Yeah. Right. I
29:32
agree. Yeah. I know you're right. I
29:36
didn't even think of that point, but to me that,
29:38
that one's not a good one. A
29:40
number of inactive or orphan accounts. Now
29:42
this one I like. I like this one too. This
29:45
is now I, I do think if you're doing identity
29:50
governance and you're adding say 10 systems per quarter,
29:54
you're going to increase the number of orphan
29:57
accounts each quarter when you add those applications.
30:00
So you have to understand that
30:02
with growth of that platform, you're going to
30:05
find more orphans and more inactives, but steady state.
30:10
If you can somehow adjust for
30:12
that increasing orphaned accounts, increasing inactive
30:15
accounts, like that's some, that just shows that's work
30:19
that you need to do. And if you can reduce that
30:22
number over time and you're keeping your environment
30:24
clean. So I think actually that's a
30:26
good metric. And then the last one is I am
30:30
policy compliance. Absolutely something that should be
30:33
tracked. I don't think it's easy to
30:35
track within an I am system. I
30:39
think there are ways, you know, like that's one of
30:42
my big things in life, which is that you're, you
30:46
know, the policies that you create are the rules of
30:49
the road and whether systems are leveraging your
30:52
central I am systems or not, they still need to
30:56
apply comply with the policies. You
30:58
have to have some way to test the adherence to those
31:01
policies or track the adherence at least. But
31:05
that's very hard to do with an I am system. Yeah,
31:09
that's more like a, I don't know, that's something
31:12
I would definitely see a kind of a manual dashboard
31:13
somewhere, percentage of applications using single
31:17
sign on percentage of applications using MFA,
31:20
maybe even, you know, critical apps using MFA,
31:23
non -critical apps using a different type of MFA right
31:26
over the media. But yeah, that was a little
31:28
more wishy washy. I don't know if I would.
31:31
It's good to know, is it
31:33
executive worthy? Probably not. Unless
31:35
there's some sort of risk that you're not able to
31:37
get by and for it to say, Hey, we're trying to get
31:39
this thing on single sign on. And
31:42
XYZ group is really not being a good partner with
31:44
us to help that happen. Exactly.
31:46
If that's a major issue that you're trying to
31:48
resolve is that, Hey, we're putting out these policies
31:51
and various businesses are taking them seriously. They
31:55
don't think they apply to them. And
31:57
you can say, Hey, within this business unit, 50 % of
32:01
the applications are not compliant with our SSO, our
32:05
password policy or whatever, any of the policies, then
32:10
you can start to bring light, shine light on the
32:13
darkness. Okay. Okay. Not
32:17
bad. If you had to give us a
32:19
score from zero to 100, Hunter being perfect. It
32:23
just replicated the mind of Jim McDonald, which is a
32:25
scary thought. And zero, meaning you're
32:28
probably safe from any sort of replacement Jim. How
32:32
do you would you score this one? I
32:38
think I'm going to get this like a 50%. That's
32:42
what I was thinking. I would be real embarrassed
32:44
to just highlight those, paste it into a deck and
32:48
then show it to executives because they started picking
32:52
on you with questions. You're,
32:54
you're going to be exposed. Yeah.
32:56
You have to know your content. I
32:58
think I think it's good for us for a starter, but
33:00
yeah, I was thinking this is about halfway there.
33:02
Good start. It's
33:03
good to writing prompts. Okay.
33:04
Now let me start thinking about why these matter or
33:07
why do these answers make sense versus just here's
33:11
information. Okay. Right on. Who
33:13
cares? Like what are you trying to do
33:14
with it? All right. Do
33:15
you want to read the next one from Maria in Spain?
33:18
Yeah. What are the biggest
33:19
challenges when it comes to implementing a successful
33:22
IAM strategy in a large multinational company, give
33:26
this an executive summary format with no more than
33:30
five points. By the way, that less sentence
33:33
is something that, that Jeff had, right? Yes.
33:36
Yeah. All these, I, I had to give
33:37
this an executive summary format, no five, no more
33:40
than five points just to have it be something. None
33:43
of our mail bag questions came in with that. It's
33:46
right. Yeah. Uh, although I would be
33:47
impressed if somebody did that. Um,
33:50
so I started a new chat also just so it wouldn't
33:52
get confused with a prior question. So
33:55
that's probably a good thing for if you're
33:56
switching topics is to start fresh every time.
33:59
Yeah. So biggest challenge is
34:01
when it comes to implementing a successful
34:02
IAM strategy in a large multinational company. So
34:05
it looks like it's got the five here. Key
34:07
challenges, global regulatory complexity. That's
34:11
number one. System integration and legacy
34:13
infrastructure. Number two. Number
34:14
three is managing decentralized identities.
34:17
Number four, achieving cross
34:19
departmental buy -in and number five, balancing user
34:22
experience and security. What
34:25
do you think, Jim? Really good. Um,
34:31
I mean, sitting here looking at the first three,
34:33
I'm like really impressed. So
34:35
I did get hung up a little bit on the third
34:37
one, because when I saw managing decentralized
34:39
identity, we're not talking about like, um, self
34:44
-sovereign identity or verifiable credentials. What
34:47
we're talking about is when an organization says, you
34:51
know, we're not going to have just one central
34:53
approach to manage all the identities in one place for
34:56
enterprise, all the active directories that exists from
34:59
all the companies and all the octa universal
35:01
directories and ping directories and LDAPs and
35:05
databases. Identities are spread everywhere. And
35:08
it might even be managed by different teams and
35:10
different, you know, systems and different rules and all
35:13
kinds of stuff. Yeah. So just looking at the
35:16
first one, global regulatory compliance. Is
35:18
this one of those no particular order? Because
35:21
I think that is one of the toughest ones for, uh,
35:25
I am practitioners like you and I is that, um, you
35:29
know, the, these talk about things like GDPR, CCPA
35:33
areas that I'm not an expert in. We
35:37
have to go as practitioners and pull in the experts
35:40
and really get guidance in terms of, you know, do we
35:45
have to maintain identities in countries or certain
35:48
countries where you do and the privacy of a person's
35:51
data, you just can't take some of those things for
35:55
granted. It doesn't all work the way
35:57
it works in your country and other places throughout
36:00
the world. So I know I learned a lot
36:03
about that. Um, when I was, you know,
36:06
earlier in my identity career and working with
36:10
groups in Western Europe, like for example, Germany
36:14
and France had very strict privacy laws in terms of
36:19
you actually couldn't take some of that identity data
36:23
from their HR system, for example, and move it into
36:27
systems in the United States. And
36:30
you actually couldn't even ask for some of the
36:32
information, right? It was like, they had like, I
36:36
forget what the workers' councils, I think, is what
36:38
they called them in Germany. It's
36:39
kind of like a union where like you could only ask
36:43
certain types of questions, only collect certain types
36:46
of data. So I think this is actually
36:48
like a very important topic. What
36:50
do you think? No, I think it's, it's a
36:52
reality, right? And the world we live in is
36:54
data sovereignty, sovereignty, or whatever the
36:57
word is, where, you know, where does it stay? And
36:59
this might be a reason why you do have to have
37:00
multiple active directories, multiple tenants, right?
37:03
Just to keep data within
37:04
specific regions. I mean, you try not to, I
37:08
think you look for reasons. Do
37:09
you have to do that? First of all, and then if you
37:12
have to, what are the rules you have to play by?
37:15
And, you know, just go from
37:16
there. But I think it's a good thing
37:17
for a high level discussion and to say, hey, okay,
37:20
yeah, we need to think about what are our
37:22
regulations? Um, you know, number two is
37:25
good too. All the different integrations,
37:27
legacy infrastructure. Your answer to the first one
37:30
about what regulations may actually answer, what can
37:33
you integrate and what needs to stay and, you
37:36
know, what can you modernize or do you need
37:38
to keep around, right? Things
37:38
like that. Yeah. And I don't know if I can
37:43
specifically tie this one to identity, except my
37:50
experience in working in a large multi -national company
37:53
was that there were a lot of legacy systems,
37:56
mainframes and old systems that were hard to integrate
38:00
to. Um, and I just, I think part
38:05
of being part of a large multi -national corporation
38:08
is like, that's a fact of life. And
38:10
when you have to integrate, I am into those systems,
38:13
sometimes it's a very difficult thing to do. Um,
38:18
you know, regardless of, if you're talking about
38:21
provisioning identities, provisioning passwords, you
38:26
know, if you want to use MFA on some of the
38:28
systems, it's just, it's not even a possibility. And
38:32
so, or, or to do it, you have to like jump through
38:36
so many hoops that it becomes a near
38:38
impossibility. So yeah, that one hits home
38:43
for me as well. So then like I said, the next
38:46
one was managing decentralized identities and
38:49
the idea of that it's not all central command and
38:52
control, usually large multi -nationals. Um,
38:56
and I've seen some of that break down over time, you
39:00
know, in my, my consulting career is going into large
39:04
multi -nationals where they have made the move to one
39:08
active directory for us. And
39:10
that is a great indication that they're saying, look,
39:13
even though we have to have some level of division
39:18
of autonomy, you know, put some autonomy in various
39:21
places, some of the enterprise services just
39:24
doesn't make sense to completely delegate control,
39:28
administrative control at that level. So
39:31
it's finding the right level. Each
39:34
organization tries to figure that out for themselves. It
39:37
used to, a lot of it used to be driven by, you know,
39:40
the speed of networks from continent to continent. Uh,
39:43
I don't think that's as much the case anymore, but
39:47
I do think language time zone and just the fact of,
39:51
well, you just like, right? Things
39:55
like that. And the way that different
39:57
countries in the world approach different things. I
39:59
think it ties in with number four a little bit,
40:01
which was achieving cross -departmental buy -in. If
40:05
you don't have cross -departmental buy -in, or
40:08
even this case may cross -country buy -in, how are
40:10
you even going to try and figure out how to manage
40:12
all those decentralized accounts, identities, teams,
40:15
right? Et cetera. I
40:17
think there is, you know, that's, I think that's, I
40:19
think that's actually pretty good insight for an AI to
40:22
answer with that here. Achieving
40:25
cross -departmental buy -in is not a technical thing.
40:27
It is more of a psychological
40:29
thing, right? How are we going to convince
40:30
Jim sitting in Germany to adopt the way of Jeff
40:35
sitting in, I don't know, Italy? Right?
40:39
Is, are there things that are lining up like teeth
40:41
where it's like, okay, yeah, it makes sense, like
40:42
from a gear perspective, there might be missing, you
40:45
know, links as well. How do we make that work? I
40:47
think it's actually pretty insightful for an AI to
40:49
include that as part of the answer. So
40:50
I'm somewhat impressed by that. Yeah,
40:54
I think that's an excellent point. I
40:57
think at the most basic level, you've got
41:00
information security policy. It
41:03
has to respect local regulations and local laws
41:06
and cultures and customs. But
41:11
I think that's the underlying is like, if you
41:13
can get a common policy that applies across the
41:18
organization, and then I think it starts going layer
41:22
by layer into the technology, and that's where
41:26
you can start to run into more of the pushback. I
41:32
found it's very hard to drive major technology gains
41:37
across the globe without support from the top. If
41:43
you're doing, trying to do things always at a
41:45
grassroots level, and trying to make major changes
41:48
across the board, you're going to face a lot of
41:51
resistance. You need support from the top.
41:54
And usually it's got to like,
41:56
say, for example, the CIO gets behind. And
42:00
it's security initiative like having one active
42:02
director. If you have an organization,
42:04
there are 50 active directories and business
42:07
units and geographies have their own, you know, trying
42:11
to be the active director team and corporate and say,
42:13
Hey, why don't we make this one big active
42:16
directory, show me five thumbs. The
42:19
CEO has to get behind it. And
42:21
the CEO has to know he has the back of the CEO.
42:25
In my experience, that's kind
42:28
of what is required for driving it. I
42:31
think there's one exception. I
42:32
think there might be a scenario where it might be
42:36
a global organization, but the vast amount of revenue
42:40
is driven by one business area that can really, you
42:44
know, impose its will on the rest of the company,
42:46
because people are very upset to rock the
42:49
moneymaker. So it could be a situation
42:51
where, you know, you really need to be thinking about
42:55
what are the financial impacts, where is the money
42:58
being made? Chances are that's one thing you
43:00
want to think about is you need the moneymakers on
43:03
board with whatever strategy is that you're trying to
43:04
adopt. Yeah, excellent point. The
43:09
last one is probably just as good as the rest. Like
43:12
I. It's not what you're doing
43:14
though. User experience and security. I'm
43:16
like, OK. You did ask for an executive
43:18
summary. So the being fair, I think
43:21
that's a very good one. And
43:23
this is the lifelong battle. And
43:25
we would love to say, OK, if I do two security keys
43:29
or five to two. Help me out here. But
43:35
I don't know what you're going. I
43:35
don't know where you're going with it. Like
43:37
pass keys. Pass keys. OK,
43:39
thank you. Had a little brainstorm there.
43:42
It's Friday night. One
43:43
of the few security tools out there where you get an
43:48
improvement in both because everybody hates dealing with
43:51
usernames passwords and, you know, getting to possession
43:56
based authentication, like having control of your
43:58
device and then having a device ecosystem where you
44:02
just get away from passwords. All
44:04
that's great. But usually when you're
44:07
deploying. And. Cyber security system of
44:11
some sort. It. Has the negative if it is
44:15
improving security, it's having a negative impact on
44:18
user experience like we talk about DLP all day. To
44:22
get should be improving security. It's
44:24
making it harder to exotrate information from
44:27
the organization. But whoever sat there in their
44:30
desk is like, that DLP is blocking me from copying my
44:34
files to the jump drive. I love this thing. No
44:37
one, no one's ever said that. Yeah.
44:40
All right. Well, that was a very long way
44:41
to just say, yes, consider user experience and
44:43
security. Yeah. Well, that's part of the
44:46
show. We're almost 45 minutes. Do
44:48
I do one more? Should we get one more? We
44:51
can only do one more. All right. Carlos
44:52
from Brazil. Go ahead and read it while I
44:54
set this up. What are some trends in I am
44:57
that you think will become more important in the near
45:01
future? I'm trying to stay ahead of
45:04
the curve in my industry. Executive
45:07
summary format with no more than five points. All
45:10
right. Survey says zero trust. OK,
45:13
I guess I don't that's future, but more like
45:15
current. AI and behavior analytics, of
45:18
course, is going to say AI is important. Cloud
45:21
centric. I am. OK,
45:22
I feel like that's kind of where we're at right now.
45:26
Prioritizing user centricity and number
45:28
five, identity governance becomes essential. So
45:32
my first question to you, Jim, of these five, zero
45:35
trust, AI and behavior analytics, cloud centric, I
45:38
am a prioritized user centricity and identity
45:42
governance being essential. Do
45:44
you think these are near future from a trend
45:50
perspective? Because that's the question. I
45:53
can't take my eye off. I can't take my eye off the
45:56
last one. Identity governance is becomes
45:58
essential in the near future. Ten
46:02
years ago, maybe. Exactly. Like running water in your
46:06
house is going to become folks. That's
46:08
the trend now. Well, let's play. Let's
46:10
play devil's advocate, right? Could
46:13
you have gotten away with manual processes ten years
46:16
ago if you're, you know, let's say you're not a
46:20
super complex organization that has multinational
46:25
implications? Yeah, you probably could have
46:28
gotten away with it. Is there a better way? Sure.
46:30
But are we at the point where IGA essentially is
46:34
mandatory to even be considered doing OK at
46:37
identity? Here's the thing, Jeff. You
46:42
can't take time off of investing in technology and
46:46
information security. If you're ten years ago and
46:49
you're like, hey, we're doing manual processes. We
46:52
have 5 ,000 users. We just got, you know, these
46:55
folks who they just take care of it. Where
46:59
do you think you are now? You're
47:01
probably way behind the curve. You're
47:02
probably like, you know, getting breached and stuff
47:06
like that. You can't take a vacation from
47:08
investing. I'm not saying I agree. I'm
47:11
just trying to play AI advocate here. I'm
47:14
trying to think really hard because budgets are tough.
47:17
And if you have magic IAM
47:19
people, IAM heroes, as we like to say, running around
47:22
behind the scenes, just making it work and the
47:25
organization doesn't feel the pain of not having,
47:28
you know, modern tools, let's say. Could
47:31
you have gotten away with it? I
47:33
would argue, yes, it happens. It
47:34
still happens today, right? But
47:36
should you get away, Jeff, you can get away without
47:39
buying life insurance. But if you die, then your
47:45
family will have no money. Well,
47:46
that's their problem, not mine. If
47:50
you own your car outright, you can maybe not have
47:55
comp and collision. And then you hit a stop sign.
47:59
Stop sign jumps out in the
48:00
middle of the road and you hit it. And
48:03
now you've got a busted of car. And
48:05
that's what's happening. Like
48:06
companies are getting breached. If
48:09
they knew what they need to do, they would have
48:12
obviously done it to prevent the breach. But
48:15
under investing for years, like you're just passing,
48:19
you're just kicking the can and then the next leader
48:22
is going to, I don't know, I can't get out of that
48:26
mode on that question. So look, I'm just trying to
48:29
be the other side of the coin. I
48:33
think, I agree with this. And
48:35
that's only because really, IGA within the last 10
48:39
years has been solved for the most part. It's
48:43
a mature space. Gartner doesn't do magic quadrants
48:46
on it for the last, what, four years, five years
48:47
since 2019, I think. To me, that tells me it's
48:51
done. And so within the last five
48:53
years, there really isn't an excuse to say, oh, we
48:56
can't do IGA. There are plenty of price points,
48:59
you know, options for this space. It's
49:01
somewhat commoditized. There's
49:02
always new ones coming up, right? We've
49:03
had some of them on our show that are really good
49:05
as well. But I feel like this is an
49:07
area where if you're really going to do identity and
49:09
access management as a program, you need to be
49:13
doing some form of IGA identity governance. You
49:16
know who has access to what and you know why they
49:19
have the access and whether it's appropriate. That's
49:22
it. Yeah. I think you, okay. So
49:26
going through the list again, zero trust takes
49:28
center stage. I think you can still make
49:30
the argument that it's still on the way up. AI
49:34
and behavior analytics. To me, that's like, that's a
49:37
pure winner right there. I mean, listen to the show,
49:39
right? We're using it. It's
49:41
the best one. Cloud -centric IAM, I think you
49:45
can make the argument that that's still growing. Team,
49:48
team, CIM. Yeah, I mean, well, just even
49:54
the idea of like, even organizations that I've
49:58
worked with that are doing a very excellent job in
50:00
the cloud can still do better. Prioritizing
50:04
users, centricity. How can you argue with that
50:07
one? It's kind of like, you remind
50:09
yourself, be a good person, be a good person, right?
50:12
Even if you are a good person,
50:13
generally, you just have to keep reminding yourself, be
50:16
a good person. But when it comes to identity
50:18
governance, becomes essential. I'm
50:21
not buying on that. I want that old hat. That
50:25
should have been, but for you individually, if you're
50:28
not doing it or you're underinvested in that area
50:31
and you just know you're not doing a good job with
50:33
it, do a good job. Okay. Well, I disagree. I
50:36
think it is mandatory or let's just say, I think
50:39
it's essential now. I think there were, I think
50:43
there were arguments to be made that it wasn't
50:45
necessarily as essential 10 years ago with some very
50:50
big asterisks next to it. It's
50:52
not like, finance regulatory reasons, right? Things
50:55
like that. But I think as identity becomes
50:58
much more the new perimeter, it's at the
51:00
center, right? It's the name of a podcast. You
51:02
have to have governance around that. You
51:05
have to have things like single sign on. You
51:06
have to have MFA. You have to know that kind of
51:07
thing. So I'm going to, I'm, this is
51:09
a hill I'm around. You can't say you disagree. You
51:12
said, identity governance is essential now. But
51:15
that's not what it says. It
51:17
says identity governance becomes essential. Meaning
51:19
it's not essential now. It will become essential.
51:22
That's not true. Well,
51:25
I think it's based on the maturity organization, the
51:27
sizing industry. So let's read the rest of it.
51:30
So identity governance becomes
51:31
essential as organizations sprawl keeping track of who
51:34
has access to what becomes difficult. I
51:36
would agree with that. Identity
51:38
governance tools will gain priority allowing you to
51:40
visualize and manage access rights and enforce lease
51:42
privilege. Right? I don't, you know, that's
51:45
a little bit too floaty for me at the end there.
51:48
But the idea of you do need
51:50
to know who has access to what the larger your
51:52
organization and as the organization sprawl. Yeah,
51:55
I would agree with that. You'd
51:57
need automation too. Otherwise
51:59
it becomes. I kind of want that. You
52:02
do as much as you can with the people you have.
52:06
I did want to bring up AI
52:08
and behavior analytics because it's on the
52:10
interday jobs we work for RSM and one of our peers
52:15
put on a presentation about AI governance. Was
52:19
that Dave Mahoney, the man? Dave
52:21
Mahoney? Were you on that? No,
52:22
I wasn't able to catch that. I
52:23
got to watch for replay on it because I was in middle
52:25
of another meeting. But yeah, Dave's the man. So
52:27
Dave, you're listening. I'm looking forward to see what
52:29
you put out there. But Jim, go for it. No,
52:31
it was really good. So, um, he's talking about
52:34
like, you know, companies really need to have, you
52:37
know, starting point is you have to have a policy
52:39
around AI. And I asked the question like,
52:43
what are, there's so many use cases for AI, right?
52:46
There's AI in products that you
52:49
buy. So let's say you buy an IM
52:52
system and it's got AI or N number of tech systems.
52:57
It's got AI, right? Maybe
52:58
it really has AI or maybe they're calling it AI
53:01
either way. You know, you start plugging
53:04
information into it. You should know, I think,
53:07
what's happening with it. Other
53:09
use case for AI is people doing like what we're
53:12
doing. You're typing a bunch of
53:14
information into an AI prompt. What's
53:17
happening with that information? Does
53:18
your company trust or want your employees doing that
53:22
or not? Do you want to put some rules
53:24
around it? Etc. There's, um, you could be
53:29
deploying IT systems that you build your own AI
53:32
into. Let's say I'm building a website
53:35
for our clients to go to and they can start using a
53:39
chat bot to solve their issues. And
53:43
I wrote some kind of AI formula or maybe I use
53:45
some open source AI and you have policy around
53:48
like, you know, who's I have to go through? The
53:52
last use case is let's say we build, build products
53:57
and we build AI into it. So
53:59
I make smart home sensors and I want to build AI
54:03
into that. You know, you should have
54:07
policy around that. So I just think it's such a
54:11
fascinating area and we're really like, it's just like
54:15
the cloud actually where I kind of feel like the
54:18
cloud was out there and devs went out and said,
54:21
wow, this is great. We can build these apps and
54:24
then they started building things that went from pre
54:27
production to okay, now we're going to use it for
54:29
production. And then information security
54:32
comes along and you're like, oh, we got to put
54:34
some guardrails on this thing. I
54:36
feel like that's what's going to happen with AI.
54:38
It's like, you know, people are
54:39
using AI every day. People are building AI into their
54:44
products, deploying software into their enterprise that
54:48
uses AI. It's about to get an
54:51
interesting. Yeah, I mean, already is, I
54:53
think, and I think that's, it's a wave that's coming.
54:57
I don't think you can stop
54:58
it. What I think you can do is
54:59
educate about it. Make sure that your, your
55:03
workforce or your users or employees or contractors or
55:06
whatever, understand the ramifications of how they
55:08
can use it. Yeah, but all the guardrails in
55:10
the world, you want, okay, we can access our computer.
55:12
Guess what? I'll
55:12
put it up on my phone and do it there. There
55:14
are always ways around it. So
55:16
I think the education is super important right now
55:18
to make people aware of, yeah, if you type in
55:21
people's names into Google and Gemini Advanced, guess
55:24
what? They're in a learning model now
55:25
somewhere. That's why I don't have the names
55:27
listed here, right? I just still it down to just
55:30
a question and, you know, should be relatively benign,
55:33
but you need to be aware of what's being put into
55:36
those models. And I think it's important for
55:39
education. Okay, it's Friday night. I'm
55:43
ready to be done. Should we end on a lighter note?
55:46
I would love to. Okay.
55:48
Would you rather have the ability to teleport or the
55:51
ability to read minds? I would love to be able to
55:56
read minds, but I'm a little afraid of what would
55:59
happen. Like if I started realizing
56:01
people. Yeah, what am I thinking right
56:03
now, Jim? Yeah, exactly. Well,
56:05
I'm sure it's not great. And
56:08
so I think I would like it, but I'd like to be
56:10
able to turn it off and on. Teleporting
56:13
would be pretty awesome, man. I
56:16
wonder if you don't get any miles. How
56:19
are you going to get platinum status or diamond
56:21
status with Delta or whoever? If
56:23
you're just teleporting, what's the fun in that?
56:25
Just think about it. You
56:26
would not need miles. Can you imagine a commute? It'd
56:31
be a truly global, you know, thing if we could
56:34
figure out teleportation where, you know, my job is
56:37
in Amsterdam, but I commute from Asheville, North
56:39
Carolina every morning. So here's a better question. I
56:43
don't think mind reading is likely to. I
56:48
shouldn't say that. Put that aside. Do
56:51
you think that someday humans will figure out how
56:54
to do teleportation? I don't know because I'm not
57:01
smart enough to know if it's within our
57:03
understanding of science and physics and all the things
57:06
that could happen. But what I am, and I feel
57:09
like I read something within the last year or so
57:12
that talked about teleporting like a single
57:15
atom. I don't know exactly what it
57:17
meant. I'm too dumb to even figure
57:20
out what the article is about. So
57:22
I feel like if it's within the realm of possibility,
57:25
eventually we would figure out something like that.
57:27
But if it truly is like an
57:29
unbreakable rule of the universe, whatever that
57:31
means, then obviously I don't think it would ever
57:34
happen. But I'm not going to rule it
57:35
out. I mean, I'm, you know, we're
57:37
carrying around cell phones. You
57:39
know, we're recording this podcast through the internet
57:41
and we can see and talk to each other. I
57:43
mean, that would have been magic, you know, 10 years
57:45
ago, even 15 years ago. Yeah.
57:49
I mean, if you if you think about it, the the
57:52
laws of the universe, one of the laws of the
57:54
universe, nothing can travel faster than light, which
57:59
means we'll never be able to get to other galaxies.
58:02
Then unless you figure out some
58:04
sort of wormhole folding space, right, sci -fi stuff
58:08
like that. Hundreds of thousands of years with
58:11
the technology that we have right now, I think to
58:16
answer the question myself is that if you were to
58:19
take this cap and you were to teleport it, what you'd
58:23
actually teleport is a copy of it. So
58:25
to our eyes, it'd be maybe indistinguishable. But
58:29
I think the thing with with a person or an animal
58:34
is that it would also be a copy. And
58:37
the thing with personal animals that you have
58:39
electrical and chemical signals going from your
58:42
brain. So I kind of feel like you
58:45
can make a copy of the mass, but probably not of
58:49
the energy and that you probably be transported and
58:52
then like, what would happen? Probably.
58:56
Interesting. Drop dead. Or
58:58
yeah, what if it's more of a instead of a of a
59:00
teleporter, a replicator, right now I'm now taking
59:03
Star Trek, you know, T Earl Gray Earl Gray hot.
59:06
Right. No, I'll take that. I
59:08
bet honestly, that would be that'd be enough for me.
59:10
So I'm gonna change my answer
59:11
and I'll just take the replicator. Well,
59:14
that wasn't the question. It
59:15
was teleportation or the ability to read minds. My
59:18
gut reaction is of course read minds. I'd
59:19
always want to know, okay, what's going on so I can
59:22
kind of figure things out and make sure that, you
59:24
know, I'm on the, but that I'm on the good side of
59:27
whatever it needs to be. But
59:28
then you did mention the thing about being able to
59:30
turn it off. And I was like, oh yeah, that,
59:32
you know, that could be pretty crowded in someone's
59:34
head for a while. Yeah. Yeah. So
59:39
if I can turn it off ability to read minds, if
59:41
I can't turn it off, then yeah, I'm going to
59:43
sacrifice my Delta diamond status and go with
59:45
teleportation. Have you ever, have you ever
59:48
heard or have you ever seen the show True Blood?
59:52
Yeah, of course. Okay,
59:53
I only saw it because didn't use someone to watch
59:56
it. It's not my kind of show. I
59:57
liked it. I thought it was great. She
59:59
could read minds, right. And
1:00:01
it like would drive her crazy sometimes. Yeah.
1:00:04
I mean, that's, that's typically the drawback you
1:00:06
see in any sci -fi thing is if you can read minds,
1:00:08
how do you filter out like Professor X from the X
1:00:11
men, right? Same thing. And,
1:00:14
you know, other characters of the like that can do
1:00:17
that kind of stuff. Okay. We got really fantastical.
1:00:19
You're on a Friday. I
1:00:20
don't know what you're talking about anyway. Yeah.
1:00:23
All right. Let's keep this under an hour.
1:00:25
We'll wrap it up there. We're
1:00:27
on the web IDCpodcast .com on Twitter X whatever it's
1:00:30
called at IDC podcast. Mastodon
1:00:33
at IDC podcast at info sector exchange reached out
1:00:37
on LinkedIn and connect with Jim and myself. If
1:00:40
you're interested in attending the happy hour,
1:00:43
whatever it is we're trying to do at IDeniverse reached
1:00:44
out to Jim or I on LinkedIn and follow us on
1:00:47
YouTube. We're starting to build up that
1:00:48
channel. So like subscribe, get
1:00:51
notified. All of our audio episodes are
1:00:53
already there, but we're going to try to put some
1:00:55
more video stuff up there too. So
1:00:57
you want to, you know, subscribe and hit that bell
1:00:59
to be notified when new ones come in. So,
1:01:01
all right, ring the bell, ring the bell. All
1:01:04
right. That's it. Thanks
1:01:05
everyone for listening and we'll talk with y 'all in
1:01:07
the next one. .